The era of annoying CAPTCHAs and constant authentication checks may be coming to an end. Cloudflare has announced a joint initiative with Mozilla, Google, and Microsoft to develop a new Internet protocolthat aims to change the way websites distinguish real users from malicious bots, without sacrificing privacy. The new protocol, called Private Access Control Tokens (PACT), is also being developed with Shopify and is intended to become an open Internet standard. Its main goal is to replace today's verification practices by offering anonymous tokens that confirm that a connection is being made by a real user or an authorized automated system.
Bots now dominate the internet
The announcement comes at a time when the internet is experiencing a historic upheaval. According to data from Cloudflare Radar, automated traffic has surpassed human activity on the web for the first time. About 58% of HTTP requests now come from bots and automated systems, while real users account for just 42%.
The explosive growth of artificial intelligence has dramatically accelerated this transition. Apps and digital assistants based on large language models, such as ChatGPT and Gemini, are driving a huge volume of web visits every day, searching for information, data, and content. Cloudflare estimates that the transition to a machine-dominated internet has occurred about 18 months earlier than initially predicted.
See also: Katz Stealer targets Chrome, Edge, Brave and Firefox
How PACT works
The logic behind PACT is based on the issuance of anonymous digital tokens by websites that have already verified a visitor's identity. The browser stores these tokens and can present them to other websites as an indication that the connection is coming from a real person.
The most important feature of the new approach is that tokens do not allow for tracking of user activity. They do not store browsing history, do not create permanent identifiers, and do not facilitate the creation of detailed digital profiles.
A new balance between security and privacy
The need for a new protection model is becoming increasingly urgent. Most modern bot detection techniques rely on collecting large amounts of information about users' devices and behavior. The practice of browser fingerprinting, detecting installed extensions, and constantly monitoring visitors' movements have provoked strong reactions from both privacy organizations and regulators.
PACT attempts to offer a different approach. Instead of websites collecting more data, they can rely on a trusted authentication system that requires significantly less information from the visitor.
See also: Chrome & Firefox: Fix critical use-after-free vulnerabilities
The internet is entering the era of AI agents
The companies behind the project recognize that the future of the internet will not be solely comprised of human users. Digital AI agents will increasingly perform tasks on people's behalf, from information searches to shopping and online transactions.
PACT is not designed to exclude this new generation of automation. It aims to separate authorized and legitimate AI agents from malicious bots, scrapers, and systems used for attacks, fraud, or mass data collection.
Why e-commerce is closely following developments
Shopify’s inclusion is no coincidence. In ecommerce, every extra verification step increases the chances of a purchase being abandoned. A wrong CAPTCHA or an overly-extensive security check can turn a lead into a lost sale.
See also: Firefox 145 and Chrome 142 fix serious vulnerabilities
A system like PACT promises a smoother user experience, reducing barriers during transactions while maintaining a high level of protection against abuse.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The big bet of the next day
The new protocol is based on Privacy Pass and related IETF, but its universal adoption will not be easy. Turning a new specification into technology that will work across billions of browsing sessions takes time, coordination, and broad industry acceptance.
The key question is whether websites will accept a system that gives them less data about their visitors. In an era where privacy is becoming increasingly valuable, the success of PACT could define how the open web works for years to come.
